I managed to create a members only area in my website and it works fine with one exception: some of the entries have PDF’s attached and these PDF’s are only hidden not protected (you can see them if you know the URL).

Is there a way to protect the attached files?

Thanks

You would need to use .htaccess to protect that directory, and then a password box would popup for those members.  I’m also not sure how to tie .htaccess to EE’s authentication, or if you can….

When people get to open the PDF they are already logged in (EE’s authentication) so another authentication box would be annoying. 

In addition, there are tools like linklok from Vibralogix that can remove files completly from the webroot - so they are only accessible through a specialized link (and that would only appear in your members only entries). However, to get that working you would need to have access to a path outside your webroot (to place the files here) which might not be true if you’re on some shared webhosting accounts.

-Markus

My first thought was to place the PDF files outside the webroot and use PHP to read the file but I couldn’t get EE to upload files outside the webroot.

Without a specialized script, that might not be possible with EE. The mentioned linklok scripts mostly focus on a payment solution, while linklok URL will protect files without the payment gateway. Its the only script I remember from scratch - but there may be other scripts freely available doing the same ... I’d search hotscripts.com for a solution.

However, upload und creating a special download link will require additional steps outside of EE ... perhaps not very handy if you use a lot of PDF documents.

-Markus